User roles & certificate policy controls made simple